Hello, sometime ago i went to travel somewhere for a week and came back, my computer got this virus!
It was fine when i left my computer and it’s very annoying now, avast keep detecting it twice everytime i open a new tab on Internet Explorer(and it seems to be fine with Firefox)
I really need some help with the removal of this nasty virus, can someone help me please? Thank You
hey and welcome to the forum.
plaese follow this guide and attach your logs
http://forum.avast.com/index.php?topic=53253.0
could you also provided a pic of that url from avast.
here are the logs and the picture
thank you very much!
please help i’m afraid this will get worse since i saw some desktop.ini popping up everywhere 
thank you
Malware removers are notified, it may take hours before one arrive so be patient…also consider what time of year it is 
The desktop files are system files and will be re-hidden on completion
After this run can you let me know if you are still getting the alerts
Warning This fix is only relevant for this system and no other, using on another computer may cause problems
Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot
Run OTL
[*]Under the Custom Scans/Fixes box at the bottom, paste in the following
https://dl.dropbox.com/u/73555776/OTL_Fix.GIF
:OTL
FF - prefs.js..browser.search.defaultenginename: "Facemoods Search"
FF - prefs.js..browser.search.selectedEngine: "Facemoods Search"
FF - prefs.js..browser.startup.homepage: "http://start.facemoods.com/?a=bf2"
FF - prefs.js..extensions.enabledAddons: ffxtlbr@Facemoods.com:1.2.6
FF - prefs.js..extensions.enabledAddons: {e968fc70-8f95-4ab9-9e79-304de2a71ee1}:0.7.3
FF - prefs.js..extensions.enabledAddons: wtxpcom@mybrowserbar.com:6.6
FF - prefs.js..extensions.enabledAddons: ytd@mybrowserbar.com:6.6
[2011/08/22 15:52:36 | 000,000,000 | ---D | M] (Facemoods) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\uog3e3c1.default\extensions\ffxtlbr@Facemoods.com
[2011/02/08 12:25:36 | 000,000,000 | ---D | M] (Mitter Toolbar) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\uog3e3c1.default\extensions\tagiritoolbar@tagiri.jp
[2011/06/23 18:30:02 | 000,004,669 | ---- | M] () (No name found) -- C:\Users\user\AppData\Roaming\mozilla\firefox\profiles\uog3e3c1.default\extensions\ffxtlbr@Facemoods.com\content\xpiInstallLgc.js
:Commands
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]
[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.
Thank you very much for helping!!
here is the log and yes im still getting the alerts
Did you install Thunder network ?
yes i did, is it the source of the virus?
Could you temporarily uninstall it and let me know if the alerts cease
hello, i have removed the thunder network and the alerts are still popping up
OK bigger hammer time
Download and Install Combofix
Download ComboFix from one of the following locations:
Link 1
Link 2
VERY IMPORTANT !!! Save ComboFix.exe to your Desktop
- IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
[*]Double click on ComboFix.exe & follow the prompts.
[*]Accept the disclaimer and allow to update if it asks
http://img.photobucket.com/albums/v706/ried7/NSIS_disclaimer_ENG.png
http://img.photobucket.com/albums/v706/ried7/NSIS_extraction.png
[*]When finished, it shall produce a log for you.
[*]Please include the C:\ComboFix.txt in your next reply.
Notes:
- Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
- Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
- If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.
Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now
hi, here is the combofix log and i dont know if it matters but when i sign in to my email or facebook etc, the security alert would pop up and it never does that before. and i cant sign in to forums,etc stuff that requires signing in. And the alerts are still popping up as usual
thank you
This one is elusive and appears to be a programme updater of some sort
[*]Run OTL. Make sure all other windows are closed and to let it run uninterrupted.
https://dl.dropbox.com/u/73555776/OTL_Main_Tutorial.gif
[*]Select All Users
[*]Under the Custom Scan box paste this in
netsvcs
BASESERVICES
%SYSTEMDRIVE%*.exe
/md5start
services.*
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
winsock.*
/md5stop
CREATERESTOREPOINT
[*]Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
.
[*]Post the log
here is the new log, thank you
I will be disabling the Tencent updater
Warning This fix is only relevant for this system and no other, using on another computer may cause problems
Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot
Run OTL
[*]Under the Custom Scans/Fixes box at the bottom, paste in the following
https://dl.dropbox.com/u/73555776/OTL_Fix.GIF
:OTL
FF - prefs.js..browser.search.defaultenginename: "Facemoods Search"
FF - prefs.js..browser.search.selectedEngine: "Facemoods Search"
FF - prefs.js..browser.startup.homepage: "http://start.facemoods.com/?a=bf2"
FF - prefs.js..extensions.enabledAddons: ffxtlbr@Facemoods.com:1.2.6
FF - prefs.js..extensions.enabledAddons: wtxpcom@mybrowserbar.com:6.6
FF - prefs.js..extensions.enabledAddons: ytd@mybrowserbar.com:6.6
FF - prefs.js..extensions.enabledItems: tagiritoolbar@tagiri.jp:2.6.7
[2012/12/27 21:10:16 | 000,000,000 | ---D | M] (No name found) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\uog3e3c1.default\extensions\ffxtlbr@Facemoods.com
[2012/12/27 21:10:16 | 000,000,000 | ---D | M] (No name found) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\uog3e3c1.default\extensions\tagiritoolbar@tagiri.jp
[2011/06/23 18:30:02 | 000,004,669 | ---- | M] () (No name found) -- C:\Users\user\AppData\Roaming\mozilla\firefox\profiles\uog3e3c1.default\extensions\ffxtlbr@Facemoods.com\content\xpiInstallLgc.js
O2:64bit: - BHO: (no name) - {004B0726-A010-4ABF-8556-FCDB7F1FCA1E} - No CLSID value found.
O2 - BHO: (IE2EMBHO Class) - {0A0DDBD3-6641-40B9-873F-BBDD26D6C14E} - C:\Program Files (x86)\easyMule\modules\IE2EM.dll (VeryCD.com)
O2 - BHO: (no name) - {889D2FEB-5411-4565-8998-1DD2C5261283} - No CLSID value found.
O2 - BHO: (IE Search Helper) - {F5765342-8574-8EA7-9758-CF79DF73AF3B} - C:\Program Files (x86)\TENCENT\SOSOAddr\ieaddr.dll (??)
O3 - HKU\S-1-5-21-2451559130-3535924385-1227171972-1000\..\Toolbar\WebBrowser: (no name) - {6B896ADB-4A82-46E2-858C-13134782CE34} - No CLSID value found.
O4 - Startup: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\??iTudou.lnk = File not found
O4 - Startup: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\??iTudou.lnk = C:\Program Files (x86)\Tudou\iTudou\iTudou.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
:Files
C:\Program Files\TENCENT\AddrUpdate\AddrUpdate.exe
:Commands
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]
[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.
here is the new log, thank you very much!
If you are still getting the alerts could you let me know the full HTTP that is being blocked
the two https are
and
thank you
They appear to be part of youtube
Go to control panel Flash Player
Under storage select block all sites from storing data
Under advanced select delete all